The Federal Trade Commission announced that it had reached a $15 million settlement with ChoicePoint Inc., the commercial data broker that disclosed last February that thieves had duped the company into turning over private data on more than 145,000 Americans.
The data breach involved thieves posing as small-business customers who gained access to ChoicePoint's vast troves of consumer information — including names, Social Security numbers, address histories and dates of birth of 145,000 Americans. The FTC said the number presently stands at 163,000. The company discovered the breach more than four months before publicly disclosing the information in February 2005.
In the complaint, the F.T.C. claimed that the company did not have "reasonable procedures" in place to screen would-be subscribers to its databases and that in this case, the applications for access made by the fake businesses should have raised "obvious red flags."
The company did not, for instance, raise questions when an apartment number or a commercial mail drop was given as a business address, or when cell phone numbers were provided as a "business's sole telephone number," according to the agency's complaint. Multiple applications from nominally different businesses arriving from the same commercial fax number also did not prevent the applications from the fake companies from being approved, the commission charged.
The sloppiness ultimately allowed the most highly regulated data that ChoicePoint holds — credit histories — to fall into the hands of the fraudulent businesses. That put the company in violation of the Fair Credit Reporting Act, which more typically governs the financial and consumer credit reporting industries, and opened it up to record-setting penalties.
The settlement includes $10 million in fines — the largest civil penalty ever imposed by the FTC, as well as $5 million in consumer compensation, stemming from accusations that its handling of consumer data and its inadequate security procedures amounted to violations of consumer privacy rights and federal law.
Ms. Parnes, an associate of the F.T.C, said "the $5 million for consumer compensation would be held in an account and distributed to people who can demonstrate real damages suffered as a result of the ChoicePoint breach."
She expected that more than 16 people would qualify.